An instruction-based security auditor that analyzes AWS security group exports to identify dangerous internet exposure and provide hardened remediation rules.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-group-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-group-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AWS Security Group Auditor?
The AWS Security Group Auditor is a specialized tool within the Openclaw Skills ecosystem designed for privacy-conscious security professionals. Unlike traditional scanners, this skill operates on a zero-access model; it analyzes data you export and provide, ensuring that no direct access to your AWS environment is required. It serves as an expert network security layer that identifies the fastest paths for attackers, such as broad CIDR blocks and open administrative ports.
By leveraging this skill, developers can perform deep audits of VPC configurations, EC2 instances, and RDS databases. It synthesizes complex JSON data into actionable reports, highlighting critical vulnerabilities while providing the exact JSON configuration needed to tighten security without disrupting service. This approach makes it a vital part of any Openclaw Skills collection for maintaining a robust security posture.
AWS Security Group Auditor Use Cases
- Detecting publicly accessible management ports like SSH (22) and RDP (3389) across large VPCs.
- Identifying database ports (MySQL, PostgreSQL, MongoDB) exposed to 0.0.0.0/0 or broad internal ranges.
- Performing a blast radius assessment to see how a single compromised instance could affect the wider network.
- Auditing complex security groups with over 20 rules to simplify and reduce the attack surface.
How AWS Security Group Auditor Works
- The user executes local AWS CLI commands to export security group, instance, and VPC configurations to JSON files.
- The skill parses the inbound and outbound rule sets to identify every source CIDR and associated port range.
- It flags dangerous exposure patterns, such as sensitive ports open to the entire internet or overly broad internal masks.
- A comprehensive risk report is generated, ranking findings by severity and potential blast radius.
- The auditor provides ready-to-use replacement rules and AWS Config recommendations to prevent future misconfigurations.
AWS Security Group Auditor Setup
To use this tool effectively within the Openclaw Skills framework, you must provide exported data from your AWS environment. Run the following commands to gather the necessary data:
# Export all security group rules
aws ec2 describe-security-groups --output json > security-groups.json
# Export EC2 instance metadata for blast radius analysis
aws ec2 describe-instances --query 'Reservations[].Instances[].{ID:InstanceId,SGs:SecurityGroups,Type:InstanceType,Public:PublicIpAddress}' --output json > instances.json
Once exported, paste the contents of these files into your session for the auditor to process.
AWS Security Group Auditor Data Schema & Taxonomy
The skill processes structured JSON data from the AWS EC2 service. It maps findings using the following taxonomy:
| Data Point | Description |
|---|---|
| Security Group ID | The unique identifier for the audited rule set. |
| Source CIDR | The IP range permitted to access the resource (e.g., 0.0.0.0/0). |
| Risk Level | Categorized as Critical, High, or Medium based on port sensitivity. |
| Blast Radius | A calculation of how many resources are impacted by a specific rule. |
| Remediation | Tightened JSON rule definitions for immediate implementation. |
AWS Security Group Auditor Advanced Features
- Support for IPv6 auditing to detect dangerous ::/0 ingress rules that are often overlooked.
- Automated generation of AWS Config rules to monitor and enforce security group compliance.
- Specific recommendations for migrating from public SSH access to AWS Systems Manager Session Manager.
- Complexity detection for security groups with high rule counts to prevent management drift.
SKILL.md
Loading
Related Openclaw Skills
AWS Secrets & Credential Exposure Scanner
A specialized security analysis tool for detecting hardcoded secrets, API keys, and credential misconfigurations within Infrastructure as Code (IaC) and configuration files.
AWS S3 Exposure Auditor
A security auditing skill that identifies misconfigured S3 buckets and generates hardened policies using your exported AWS data.
AWS RI and Savings Plans Advisor
An AI-driven financial advisor that analyzes AWS usage data to recommend the most cost-effective Reserved Instance and Savings Plan strategies.
Azure Reservations & Hybrid Benefit Advisor
An AI-driven advisor that analyzes Azure usage data to recommend optimal Reservation and Hybrid Benefit stacking for maximum cost savings.
AWS Spend Analyzer
A professional FinOps analysis tool that processes AWS billing data to identify cost-saving opportunities and expenditure anomalies.
AWS Spot Instance Strategy Builder
A technical advisor skill for designing interruption-resilient EC2 Spot instance strategies and fallback configurations based on infrastructure data.
Featured*
